Jamf Pro Overview—Macos Smart Card Functionality
Total Page:16
File Type:pdf, Size:1020Kb
Jamf Pro Overview macOS Smart card Functionality Page 1 of 26 Jamf Pro Overview 1 Overview 6 History 7 Mac OS X 10.6 and below 7 Mac OS X 10.7 - 10.12 7 Mac OS X Sierra 10.12 - macOS High Sierra 10.13 7 Mac OS X Sierra 10.12.0-10.12.4 7 Mac OS X Sierra 10.12.4 - macOS High Sierra 10.13.1 7 macOS High Sierra 10.13.2 8 macOS High Sierra 10.13.4 8 macOS Mojave 10.14.0 - 10.14.6 8 macOS Mojave 10.14.6 8 macOS Catalina 10.15.0 9 Pre-10.12 Support 10 Additional USB Drivers 10 FileVault 11 Basic Setup 11 Advanced Setup 11 Active Directory 12 Native Support for AD bound Macs 12 Local User Account - Attribute Mapping 12 Mobile User Account - Attribute Mapping 12 Advanced Integration 13 Configuration Profile 14 Note 15 Jamf Pro 10.3 15 Enforce Smart card 16 Verify Smart card Certificate 16 Jamf Pro 10.12 16 Mandatory use of Smart cards 17 1. Device Enrollment 17 Page 2 of 26 2. Enforce FileVault 17 3. Set up a FileVault User 17 4. Smart card Pairing 17 Non-Directory Services 17 Active Directory 17 5. Configuration Profile 18 6. Terminal Commands 18 Alternative Distribution 19 Scripts 20 Enforce ‘sudo’ to use Smart card 20 Enforce ‘su’ to use Smart card 20 Enforce ‘login’ to use Smart card 20 Enforce Screensaver to activate on removal of Smart card 20 Active Directory Attribute Mapping 21 Extension Attributes 22 Validate Smart card Pairing is enabled 22 Review if a Smart card is in User’s Keychain 22 Display Smart card enabled user 22 Smart card Logging 22 Review Screensaver Setting for Smart card Removal 22 Review if ‘login’ command has been protected with Smart card Authentication 23 Review if ‘sudo’ command has been protected with Smart card Authentication 23 Review if ‘su’ command has been protected with Smart card Authentication 23 Troubleshooting 24 Validate Smart card Pairing is enabled 24 Review if a Smart card is in User’s Keychain 24 Smart card Logging 24 Review the hash for Smart card enabled user 24 Smart card Manual 24 Smart card Diagnostic 24 System-wide Diagnostic Report 25 PAM Module 25 Page 3 of 26 Review current Login Window Settings 25 Smart card Information from System Profiler 25 Review the list of Smart cards 25 References 26 Apple Documentation 26 TokenD 26 CryptoTokenKit 26 MDM Reference 26 PIV Mandatory 26 Page 4 of 26 © 2018 Jamf. All rights reserved. Jamf has made all efforts to ensure that this guide is accurate. Jamf 100 Washington Ave S Suite 1100 Minneapolis, MN 55401-2155 (612) 605-6625 Apple, the Apple logo, macOS, Mac OS X, macOS High Sierra 10.13, macOS Sierra 10.12, CryptoTokenKit, FileVault, are trademarks of Apple Inc., registered in the United States and other countries. App Store is a service mark of Apple Inc., registered in the United States and other countries. Jamf Pro, Jamf, the Jamf Logo, are registered or common law trademarks of JAMF SOFTWARE, LLC in the U.S. and other countries. All other product and service names mentioned herein are either registered trademarks or trademarks of their respective companies. Page 5 of 26 Overview With user-friendly and easy to use products, along with an ever-expanding ecosystem of apps and resources, it’s no surprise that Apple continues to make substantial strides in enterprise settings around the world. Apple devices all come with built-in security features that make them a logical choice for any security-conscious organization. However, government and financial sectors often need more than what Apple offers out of the box. To accommodate these organizations, Smart cards can be leveraged as an extra layer of security authentication on Mac. In this white paper, we explain the history of Smart card usage with Apple and provide guidance to Jamf customers on the best methods for managing and reporting on Smart cards, like Personal Identity Verification (PIV) or Common Access Card - Next Gen (CAC-NG*), for Apple devices. You’ll learn how to: • Deploy tools like Centrify and ADmitMac PKI that contain drivers for reading Smart cards on older macOS devices • Leverage macOS built in CryptoTokenKit • Create local user accounts to support Smart cards • Support Active Directory binding natively or through additional tools • Create configuration profiles to centrally manage and enforce Smart card services • Leverage extension attributes to report on various Mac settings, including Smart cards • Troubleshoot steps if an issue should arise * CAC-NG card specification requires the card include a PIV credential This document will focus most attention on macOS High Sierra 10.13 and the Jamf Pro management solution. You should have advanced knowledge of how to use Jamf Pro in secure environments. Page 6 of 26 History Smart card support within macOS has changed over the years. Here is a record of what type of support Apple has built into each version of macOS. (Note: Most data related to this section was obtained on Cem Pava’s blog. [See References] ) Mac OS X 10.6 and below Mac OS X systems used to contain a low level module service called ‘tokend’. This service allowed native reading of certain Smart cards (1): 1. BELPIC.Tokend: Belgian National ID (BELPIC) compliant Smart cards 2. CAC.Tokend: Common Access Card (CAC) compliant Smart cards 3. JPKI.Tokend: japanese PKI (JPKI) compliant Smart cards 4. PIV.Tokend: Personal Identity Verification (PIV) compliant Smart cards 5. tokendPKCS11.so: PKCS-11 shim over TokenD (Mac OS X 10.6 only) Mac OS X 10.7 - 10.12 Smart card services with TokenD were removed from Mac OS X and moved into an open source platform. This is placed within Apple’s macOS forge site: https://www.macosforge.org Smart card Services specifically at: https://smartcardservices.github.io Customers could utilize third-party applications and drivers to support Smart cards. Centrify and ADmitMac are two primary solutions that offer support. Mac OS X Sierra 10.12 - macOS High Sierra 10.13 Apple transitioned to native support of Smart cards using CryptoTokenKit (CTK) with new management functionalities through mobile device management (MDM). More information can be found in Terminal with the ‘man SmartCardServices’ command. Legacy Smart card services using TokenD (CDSA) are still supported in Sierra and High Sierra using the GitHub project: https://smartcardservices.github.io Mac OS X Sierra 10.12.0-10.12.4 Apple built-in CTK supported Smart cards natively with command-line interface management. This can be reviewed by using “man SmartCardServices” and “man sc_auth” in Terminal. Mac OS X Sierra 10.12.4 - macOS High Sierra 10.13.1 Page 7 of 26 Apple began adding MDM Configuration Profile settings to centrally manage some components of the Smart card functionality. These included: 1. Allow Smart card 2. Only allow one Smart card per user 3. Allow user pairing 4. Verify the certificate is trusted - boolean on or off macOS High Sierra 10.13.2 A mandatory enforcement of Smart card usage was introduced to meet the US Government requirements, known as PIV-M or mandatory use of PIV credentials. This is a response to Homeland Security Presidential Directive - 12. [See References] This setting enforces Smart card on macOS functions. Terminal related functions (i.e. ‘sudo’, ‘login’, ‘su’, etc.) can be set up with Smart card mandatory authentication using settings from Page 15. This does not allow a per-user management of Smart cards. The following MDM configuration profile setting was introduced to support PIV-M. 1. Force Smart card authentication on all users Apple changed the MDM Configuration Profile key that controls the certificate trust check behavior, adding two additional options for check revocation (soft) and check revocation (hard). Soft requires the device to check revocation upon network connectivity to OCSP/CRL, whereas Hard validates revocation immediately against OCSP/CRL. 1. Check Certificate Trust (with soft revocation check) 2. Check Certificate Trust (with hard revocation check) macOS High Sierra 10.13.4 Apple added new management functionality to allow the local administrator to change the Smart card PIN using ‘sc_auth’. macOS Mojave 10.14.0 - 10.14.6 Apple added new management functionality for configuration profiles to enforce the “Lock screensaver on Smart card removal” macOS Mojave 10.14.6 Take a hash of the domain of your certificate, allowing you to identify only certain domains can pair and authenticate. PCSC bug fixes Page 8 of 26 macOS Catalina 10.15.0 Apple added updates to the “man SmartCardServices” in referencing various Smart card functionality to CTK. These include: Identity Picker - Ability to choose which identity needs to be used for authentication. User based Enforcement - No longer tied to device based enforcement. Allow login for unpair user. Ability to relax mandatory Smart card policy for an identified group of users. Allowed to make a local user group or directory based group that is allowed to bypass the Smart card mandatory (PIV-M) policy. Certificate pinning - Ability to restrict Smart card login to cards issued from specific domains TokenD is now dead. Page 9 of 26 Pre-10.12 Support Jamf Pro can assist any customer in deploying tools like Centrify and ADmitMac PKI that contain drivers for reading Smart cards in systems prior to Mac OS X 10.12. Additional USB Drivers Apple has built in support for a very wide range of PIV and CAC-NG Smart cards, therefore, the need to build any additional drivers would be rare. If you have a need to build an additional Smart card driver please review Apple’s man page for Smart card Services: OS X (macOS) has built-in support for USB CCID class-compliant Smart card readers.